buffer overflow in loongarch_elf_add_sub_reloc_uleb128
oss-fuzz managed to trigger a buffer overflow processing a bogus
leb128. Well, the leb128 encoding can be arbitrarily long so this
isn't surprising at all. If we want to guard against user input
triggering buffer overflows then we'd need to ensure input is
terminated somehow, or do as this patch does.
Remove _bfd_read_unsigned_leb128 and _bfd_read_signed_leb128,
replacing all uses of these functions with _bfd_safe_read_leb128.
* libbfd.c (_bfd_read_unsigned_leb128): Delete.
(_bfd_read_signed_leb128): Delete.
* libbfd-in.h: Remove declarations too.
* libbfd.h: Regenerate.
* elf32-msp430.c (msp430_final_link_relocate): Replace
_bfd_read_unsigned_leb128 with _bfd_safe_read_leb128.
* elf32-nds32.c (nds32_elf_relax_delete_blanks): Likewise.
* elfnn-loongarch.c (perform_relocation): Likewise.
(loongarch_elf_relocate_section): Likewise.
* elfnn-riscv.c (perform_relocation): Likewise.
* elfxx-loongarch.c (loongarch_elf_add_sub_reloc_uleb128): Likewise.
(loongarch_write_unsigned_leb128): Make "len" a size_t.
* elfxx-loongarch.h (loongarch_write_unsigned_leb128): Adjust.
9 files changed